ClawHub
Back to skill

Security audit

Grain Crawler Free

Security checks across malware telemetry and agentic risk

Overview

This skill is mainly for local Granola note search, but its broad trigger wording could cause unnecessary access to sensitive local meeting-note archives.

Install only if you are comfortable letting an agent run the grain-crawler CLI and read local Granola archive/cache content. Before use, limit it to explicit Granola note search, note-detail retrieval, and freshness checks, and avoid letting generic report or visualization requests trigger it automatically.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (2)

Vague Triggers

High
Confidence
82% confidence
Finding
The trigger condition is so broad that an agent may invoke this skill for generic data analysis, reporting, or visualization requests outside its declared purpose. In a skill with exec capability and local data access, overbroad routing increases the chance of unnecessary command execution and unintended access to local meeting-note caches containing sensitive information.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The skill discloses that it uses read and exec, but it does not clearly warn that execution will access local cached meeting notes and archives, which may contain sensitive personal or organizational data. This lack of transparent data-access disclosure can lead users or orchestration agents to authorize the skill without understanding the privacy implications of local file and command access.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.